USB流量包文件分析

USB流量

USB键盘流量抓取分析

# a keyboard maping
mappings = { 0x04:"A", 0x05:"B", 0x06:"C", 0x07:"D", 0x08:"E", 0x09:"F", 0x0A:"G", 0x0B:"H", 0x0C:"I", 0x0D:"J", 0x0E:"K", 0x0F:"L", 0x10:"M", 0x11:"N", 0x12:"O", 0x13:"P", 0x14:"Q", 0x15:"R", 0x16:"S", 0x17:"T", 0x18:"U", 0x19:"U", 0x1A:"W", 0x1B:"X", 0x1C:"Y", 0x1D:"Z", 0x1E:"1", 0x1F:"2", 0x20:"3", 0x21:"4", 0x22:"5", 0x23:"6", 0x24:"7", 0x25:"8", 0x26:"9", 0x27:"0", 0x28:"\n", 0x2a:"[DEL]", 0x2b:"\t", 0x2c:" ", 0x2d:"-", 0x2e:"=", 0x2f:"[", 0x30:"]", 0x31:"\\", 0x32:"~", 0x33:";", 0x34:"'", 0x36:",", 0x37:".", 0x82:"Casps Lock"}
nums = []
keys = open('usbdata.txt')
data = ''
for line in keys:
    line = line.strip()
    if line[0] != '0' or line[1] != '0' or line[3] != '0' or line[4] != '0' or line[9] != '0' or line[10] != '0' or line[12] != '0' or line[13] != '0' or line[15] != '0' or line[16] != '0' or line[18] != '0' or line[19] != '0' or line[21] != '0' or line[22] != '0':
        continue
    strs = str(line.split(":")[2])
    id = "0x" + strs
    if int(id,16) in mappings:
        data += mappings[int(id,16)]
    print data
keys.close()

数据提取方法1

数据提取方法2-kali

USB鼠标流量抓取分析

nums = []
keys = open('usbdata.txt', 'r')
posx = 0
posy = 0
for line in keys:
    if len(line) != 12:
        continue
    x = int(line[3:5], 16)
    y = int(line[6:8], 16)
    if x > 127:
        x -= 256
    if y > 127:
        y -= 256
    posx += x
    posy += y
    btn_flag = int(line[0: 2], 16) # 1 for left, 2 for right, 0 for nothing
    print btn_flag
    if btn_flag == 1:
        print posx, posy
key.close()